Description
All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| askbot | askbot | 0.12.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | askbot | < 0.12.3 | 0.12.3 | GHSA-r2jv-fwfr-4j8c |
References
- https://fluidattacks.com/advisories/ghost third-party-advisory
- https://askbot.com/ product
- https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d patch